2

I was running some unit tests for a web app using Karma in watch mode (so it was running a web server) and I got this output in my console between tests while the console should have been idle.

20 01 2017 13:47:35.359:WARN [web-server]: 404: /robots.txt
20 01 2017 13:47:40.490:WARN [web-server]: 404: /status.jsp
20 01 2017 13:47:41.041:WARN [web-server]: 404: /rs-status
20 01 2017 13:47:44.673:WARN [web-server]: 404: /tasktracker.jsp
20 01 2017 13:47:46.591:WARN [web-server]: 404: /.git/HEAD
20 01 2017 13:47:50.097:WARN [web-server]: 404: /nmaplowercheck1484938066
20 01 2017 13:47:50.312:WARN [web-server]: 404: /HNAP1
20 01 2017 13:48:11.679:WARN [web-server]: 404: /flumemaster.jsp
20 01 2017 13:48:20.064:WARN [web-server]: 404: /jobtracker.jsp
20 01 2017 13:48:20.948:WARN [web-server]: 404: /browseDirectory.jsp
20 01 2017 13:48:24.715:WARN [web-server]: 404: /dfshealth.jsp
20 01 2017 13:48:26.201:WARN [web-server]: 404: /master.jsp

To me it looks as if something saw I had a web server running (on the unlikely port of either 9876 or 35729 from netstat and what I know about Karma) and tried to query a bunch of possible pages to do something, my guess would be this thing is normally malicious intent.

The thing is, I'm on my company intranet with internet connection but also a 10.*.*.* address assigned to me (ipconfig /all). Unless the company specifically forwarded a port to my laptop (which they shouldn't have) there would be no way to reach my laptop externally, right?

Can anyone shed some light on what might be happening here? Unfortunately, I don't know if I can get a more detailed log than this because Karma is only meant to be for unit tests.

Improve this question

1 Answer 1

Reset to default
2

It appears that someone scanned your web server with nmap, based on the match with one of nmap's scripts:

$ grep nmaplowercheck *.lua
http.lua:  local URL_404_1 = '/nmaplowercheck' .. os.time(os.date('*t'))

which is what would cause this request:

20 01 2017 13:47:50.097:WARN [web-server]: 404: /nmaplowercheck1484938066

This is not unusual. Under certain commands nmap will throw a bunch of its scripts against any port it finds open to see what comes out; the scripts in nmap go far beyond simple port scanning functionality.

As to who did it, and why, you should have web logs that list source IP address. If you don't have that, given that the most likely cause* is an approved automated scan across your network, leave a packet capture running and wait for it to happen again.

*for an Internal network. On the Internets it's a whole different story!

Improve this answer
2
  • Ah okay, so it was probably just an internal scanning. I wasn't aware nmap had all those features. Considering Karma doesn't keep logs (at least not that I'm aware of, probably behind a flag) I'll just have to either run a real web server or do packet capture like you suggest. Thanks.
    – Cobertos
    Jan 20, 2017 at 19:39
  • flumemaster.jsp is another script that one of the nmap NSE libraries scans for, which further supports this answer. See nmap.org/nsedoc/scripts/flume-master-info.html for info on that library. As @gowenfawr says, though, there is no guarantee whether or not this is a legitimate security sweep, or just some employee running an intensive nmap scan, or an actual hacker in your environment.
    – John Deters
    Jan 20, 2017 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .